fix(security): preserve required check names in private-free migration

[rldyourmnd]

Summary

A caller migrating from the SARIF security bundle to the private-free variant can retain a required check context without changing repository protection. Add optional check_name; its default preserves the existing private-free display name. The caller may select the legacy inner name while all four scanners, aggregate failure and one-day artifact evidence remain unchanged.

Update the capability description, migration guidance and example. No paid feature or code-scanning upload is introduced.

Type of change

• Fix to an existing workflow

Threat-model note

The input is used only in jobs.security-bundle.name, never in shell commands, paths, API requests or permissions. The caller controls its display identity through reviewed workflow configuration. A semantic YAML comparison confirmed that the sole workflow changes are the optional input and job display name; every scanner and artifact step remains identical.

Permissions diff

No change: workflow permissions: {}, job contents: read. The private-free variant requires no actions: read or security-events: write scope.

Validation

• Full validate_all.py core/touched/scheduled checks passed through the isolated Python launcher.
• Full actionlint and authenticated pinned zizmor 1.26.1 passed (existing 13 ignores and one suppression unchanged).
• Exact stable 0.8.0 bundle projection check and diff check passed.
• Catalog, example, documentation and Unreleased changelog updated; generated docs remain current.
• Existing full SHA pins, checkout credential policy, timeout and scanner failure behavior preserved.
• Signed Git commit and DCO.

This is source/contract verification. A consumer run must still confirm its chosen final check context.

Tier impact

• Private free tier
• Private paid callers choosing artifact-only security reporting